Security management method and system for open source software supply chain

Abstract

The present application relates to a security management method and system for an open source software supply chain, and relates to the field of software security technology. The method comprises: collecting related information of open source software; extracting from the related information the entities in the open source software supply chain of the open source software, the software events in the open source software supply chain that are related to the security risks of the open source software, and the relationships between the entities as supply chain knowledge of the open source software supply chain; obtaining a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge; and issuing warning information and emergency response strategies for the risk events when a risk event is determined to exist in the open source software supply chain based on the supply chain knowledge graph. This method can reduce the security risks of the open source software supply chain.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a security management method, system, computer device, computer-readable storage medium, and computer program product for an open source software supply chain. Background Art

[0002] Open source software refers to software whose source code is open to the public, allowing anyone to view, use, modify and distribute it; the open source software supply chain refers to the supply network composed of open source components in the open source software and their dependencies, covering multiple aspects such as the development, maintenance, software package management and distribution of open source software.

[0003] In related technologies, since open source software allows anyone to view, use, modify and distribute it, the security risk of the open source software supply chain is relatively high. For example, malicious attackers may disguise the software package containing malicious code and publish it on the software package distribution platform to trick users into downloading it, thereby damaging the user's system using the software package. Summary of the Invention

[0004] Based on this, it is necessary to provide a security management method, system, computer equipment and computer-readable storage medium for the open source software supply chain that can reduce security risks in order to address the technical issues of the high security risks of the open source software supply chain.

[0005] In a first aspect, this application provides a method for securely managing an open source software supply chain, including:

[0006] Collect information related to open source software;

[0007] Extracting, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain that are associated with security risks of the open source software, and association relationships between the entities as supply chain knowledge of the open source software supply chain; the entities at least including components, vulnerabilities, and patches corresponding to the open source software; and the software events at least including a first software event that increases the security risk and a second software event that reduces the security risk;

[0008] Based on the supply chain knowledge, obtaining a supply chain knowledge graph of the open source software supply chain;

[0009] When it is determined that a risk event exists in the open source software supply chain based on the supply chain knowledge graph, early warning information and emergency response strategies for the risk event are issued.

[0010] In one embodiment, extracting from the association information entities in the open source software supply chain of the open source software, software events in the open source software supply chain associated with security risks of the open source software, and association relationships between the entities includes:

[0011] Based on a pre-trained knowledge extraction model, extracting components, vulnerabilities, and patches corresponding to the open source software from the associated information to obtain the entities;

[0012] Extracting, from the associated information, first software events that increase the security risk and second software events that reduce the security risk in the open source software supply chain based on the knowledge extraction model and the entities, to obtain the software events;

[0013] Extracting, based on the knowledge extraction model, from the association information and the software events, a first association relationship between the components, a second association relationship between the components and the vulnerabilities, a third association relationship between the patches and the vulnerabilities, and a fourth association relationship between the components and the patches, to obtain association relationships between the entities;

[0014] Determining the entities, the relationships between the entities, and the software events as supply chain knowledge of the open source software supply chain;

[0015] Among them, the first association relationship between two components indicates whether there is a dependency relationship between the two components; the second association relationship between each component and each vulnerability indicates whether the vulnerability exists in the component; the third association relationship between each patch and each vulnerability indicates whether the patch is a patch released for the vulnerability; the fourth association relationship between each component and each patch indicates whether the patch is applied to the component.

[0016] In one embodiment, obtaining a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge includes:

[0017] Construct the node corresponding to each entity;

[0018] Determine the connection edges between the nodes based on the association relationships between the entities;

[0019] Determining the weight of the connection edge between the nodes based on the software events;

[0020] The supply chain knowledge graph is constructed based on the nodes, the connecting edges between the nodes, and the weights of the connecting edges between the nodes.

[0021] In one embodiment, the nodes in the supply chain knowledge graph include at least a component node corresponding to each component, a vulnerability node corresponding to each vulnerability, and a patch node corresponding to each patch;

[0022] When a risk event is determined to exist in the open source software supply chain based on the supply chain knowledge graph, issuing early warning information and emergency response strategies for the risk event includes:

[0023] For each vulnerability node in the supply chain knowledge graph, determining risk information of the vulnerability node based on a connection relationship between the vulnerability node and other nodes in the supply chain knowledge graph;

[0024] When the risk information is greater than or equal to the preset risk information, determining that a risk event corresponding to the vulnerability node exists in the open source software supply chain;

[0025] Generate early warning information for risk events, and determine an emergency response strategy for the risk events based on the connection relationship between the vulnerability node and the remaining nodes;

[0026] The warning information and the emergency response strategy are issued.

[0027] In one embodiment, determining the risk information of the vulnerability node based on the connection relationship between the vulnerability node and other nodes in the supply chain knowledge graph includes:

[0028] Determining an impact area of ​​the vulnerability node in the supply chain knowledge graph based on a connection relationship between the vulnerability node and component nodes in the supply chain knowledge graph;

[0029] Determining risk information of the vulnerable node based on component nodes in the affected area and a connection relationship between the vulnerable node and the component nodes in the affected area;

[0030] The determining, based on the connection relationship between the vulnerable node and the remaining nodes, an emergency response strategy for the first software event corresponding to the vulnerable node includes:

[0031] Based on the connection relationship between the vulnerability node and the patch nodes in the affected area, determining a target patch node for repairing the vulnerability node among the patch nodes in the affected area; based on the connection relationship between the vulnerability node and the component nodes in the affected area, determining a target component node to which the target patch node is to be applied among the component nodes in the affected area;

[0032] An emergency response strategy for the risk event is determined based on the target patch node and the target component node.

[0033] In one embodiment, after obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the method further includes:

[0034] receiving a query request for the open source software supply chain;

[0035] Locating a target node associated with the query request among the nodes in the supply chain knowledge graph;

[0036] Generate a query result corresponding to the query request based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph;

[0037] The query results are displayed.

[0038] In one embodiment, after obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the method further includes:

[0039] Determining an indicator value of the open source software supply chain under at least one security risk indicator based on a connection relationship between nodes in the supply chain knowledge graph;

[0040] Display the supply chain knowledge graph and the indicator values ​​of the open source software supply chain under various security risk indicators.

[0041] In a second aspect, this application also provides a security management system for an open source software supply chain, including:

[0042] Information collection layer, used to collect relevant information about open source software;

[0043] a knowledge extraction layer for extracting, as supply chain knowledge of the open source software supply chain, entities in the open source software supply chain, software events in the open source software supply chain that are associated with security risks of the open source software, and relationships between the entities; wherein the entities include at least components, vulnerabilities, and patches corresponding to the open source software, and the software events include at least a first software event that increases the security risk and a second software event that reduces the security risk;

[0044] A knowledge representation layer, configured to obtain a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge;

[0045] The risk warning layer is used to issue warning information and emergency response strategies for the risk event when it is determined that there is a risk event in the open source software supply chain based on the supply chain knowledge graph.

[0046] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0047] Collect information related to open source software;

[0048] Extracting, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain that are associated with security risks of the open source software, and association relationships between the entities as supply chain knowledge of the open source software supply chain; the entities at least including components, vulnerabilities, and patches corresponding to the open source software; and the software events at least including a first software event that increases the security risk and a second software event that reduces the security risk;

[0049] Based on the supply chain knowledge, obtaining a supply chain knowledge graph of the open source software supply chain;

[0050] When it is determined that a risk event exists in the open source software supply chain based on the supply chain knowledge graph, early warning information and emergency response strategies for the risk event are issued.

[0051] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0052] Collect information related to open source software;

[0053] Extracting, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain that are associated with security risks of the open source software, and association relationships between the entities as supply chain knowledge of the open source software supply chain; the entities at least including components, vulnerabilities, and patches corresponding to the open source software; and the software events at least including a first software event that increases the security risk and a second software event that reduces the security risk;

[0054] Based on the supply chain knowledge, obtaining a supply chain knowledge graph of the open source software supply chain;

[0055] When it is determined that a risk event exists in the open source software supply chain based on the supply chain knowledge graph, early warning information and emergency response strategies for the risk event are issued.

[0056] The above-mentioned open source software supply chain security management method, system, computer device and computer-readable storage medium first collect the related information of the open source software; then, from the related information, extract the entities in the open source software supply chain of the open source software, the software events in the open source software supply chain that are related to the security risks of the open source software, and the association relationships between the entities as the supply chain knowledge of the open source software supply chain; each entity includes at least the components, vulnerabilities and patches corresponding to the open source software, and the software events include at least the first software event that increases the security risk and the second software event that reduces the security risk; then, based on the supply chain knowledge, a supply chain knowledge graph of the open source software supply chain is obtained; then, when it is determined that there is a risk event in the open source software supply chain based on the supply chain knowledge graph, early warning information and emergency response strategies for the risk event are issued. In this way, through information extraction, entities such as components, vulnerabilities and patches in the open source software supply chain, first software events that increase the security risk of open source software and second software events that reduce the security risk of open source software, as well as the association relationship between each entity can be extracted from the related information of open source software, thereby obtaining the supply chain knowledge of the open source software supply chain; based on the supply chain knowledge, the corresponding supply chain knowledge graph can be obtained; based on the supply chain knowledge graph, the existence of risk events in the open source software supply chain can be monitored, and in the event of risk events, corresponding early warning information and emergency response strategies can be issued; the security management method of the open source software supply chain based on the above process can provide timely early warnings for risk events in the open source software supply chain and provide emergency response strategies, thereby reducing the security risks of the open source software supply chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 1. A flowchart of a method for securely managing an open source software supply chain according to an embodiment of the present invention;

[0059] Figure 2 A flowchart illustrating the steps of extracting, from association information, entities in an open source software supply chain, software events in the open source software supply chain that are associated with security risks of the open source software, and association relationships between the entities in one embodiment;

[0060] Figure 3A flowchart illustrating steps for obtaining a supply chain knowledge graph of an open source software supply chain based on supply chain knowledge in one embodiment;

[0061] Figure 4 A flowchart illustrating the steps of issuing early warning information and emergency response strategies for risk events when a risk event is determined to exist in an open source software supply chain based on a supply chain knowledge graph in one embodiment;

[0062] Figure 5 1 is a schematic diagram of an open source software supply chain security knowledge management system based on a large language model in one embodiment;

[0063] Figure 6 A structural block diagram of a security management system for an open source software supply chain in one embodiment;

[0064] Figure 7 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0066] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0067] In one embodiment, Figure 1 As shown, a security management method for an open source software supply chain is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, or to a system including a server and a terminal, and implemented through interaction between the server and the terminal. The server can be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablet computers, etc. In this embodiment, the method includes the following steps S102 to S108:

[0068] Step S102: Collect related information of open source software.

[0069] Among them, open source software refers to software whose source code is open to the public, allowing anyone to view, use, modify and distribute it.

[0070] Among them, an open source software includes at least one open source project, and an open source project includes at least one open source component.

[0071] The associated information of the open source software includes at least first open source software information on the open source software platform and second open source software information on an Internet page related to the open source software.

[0072] In specific applications, the first open source software information includes at least the basic information of the open source software (project name, description, developer information, license type, etc.), version information (code snapshots of different versions, release time, update logs, etc.), code repository content (source code files, submission records, branch information, tags, etc.), project documentation (README files (text files used to introduce basic information about a project, software or program to users, developers or other relevant personnel), wiki pages, contribution guidelines, etc.), Issue and Pull Request information (problem description, solution status, comments), dependency information (dependent libraries, dependent versions, etc.) and security relevance information (code scanning results, vulnerability reports, etc.).

[0073] In specific applications, the second open source software information at least includes vulnerability libraries and threat intelligence (such as CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database, a comprehensive vulnerability database maintained by the National Institute of Standards and Technology of the United States) and other vulnerability databases), technical forums and community discussions (such as discussions related to open source software on open source software platforms), security research reports and white papers (such as research reports released by major security vendors) and other relevant information (such as news reports, social media discussions, etc.).

[0074] Specifically, the server obtains first open source software information related to the open source software from the open source software platform, and obtains second open source software information related to the open source software from an Internet page related to the open source software, to obtain associated information of the open source software.

[0075] In specific applications, the server is associated with a database that stores association information. Based on the differences between the currently acquired association information and the historical association information in the database, the server performs incremental or full updates to the database. For example, if the difference between the currently acquired association information and the historical association information is less than or equal to a preset difference, the server performs an incremental update based on the difference. If the difference is greater than the preset difference, the server performs a full update based on the newly acquired association information. This reduces unnecessary data transmission and processing, improving data synchronization efficiency.

[0076] In actual applications, for related information, the server can obtain related information based on the interface of the page or platform where the related information is located, or dynamically adjust the crawler strategy by identifying the structure of different pages or platforms to obtain related information through the crawler.

[0077] In practical applications, the server can perform data preprocessing on the collected related information, such as data format unification, data cleaning and standardization, and duplicate data detection and merging.

[0078] In actual applications, the server collects related information every certain period of time.

[0079] In step S104, the entities in the open source software supply chain of the open source software, the software events in the open source software supply chain that are associated with the security risks of the open source software, and the association relationships between the entities are extracted from the association information as the supply chain knowledge of the open source software supply chain.

[0080] Among them, the open source software supply chain refers to the supply network composed of open source components and their dependencies in open source software, covering multiple links such as the development, maintenance, software package management and distribution of open source software.

[0081] Each entity includes at least the components, vulnerabilities, and patches corresponding to the open source software. In specific applications, the server can also extract entity attributes of the entity from the associated information, such as the entity's name, publisher, developer, release time, release version, etc.

[0082] Software events include at least a first software event that increases security risk and a second software event that reduces security risk. In specific applications, first software events include, but are not limited to, vulnerability exposure events, vulnerability exploitation events, malicious attack events, data security events, and supply chain attack events; second software events include, but are not limited to, vulnerability fix events, patch release events, patch application events, component update events, and component release events.

[0083] Specifically, the server extracts knowledge from the associated information, extracts entities such as components, vulnerabilities and patches in the open source software supply chain of the open source software, and extracts software events such as the first software event and the second software event that have occurred in the open source software supply chain; then, based on the extracted entities and software events, the server further extracts the association relationships between the entities from the associated information, thereby obtaining the supply chain knowledge of the open source software supply chain composed of the entities, the association relationships between the entities and the software events.

[0084] Step S106: Based on the supply chain knowledge, a supply chain knowledge graph of the open source software supply chain is obtained.

[0085] Specifically, the server constructs or updates a supply chain knowledge graph for the open source software supply chain based on supply chain knowledge. In specific applications, the server determines the knowledge gap between the supply chain knowledge and historical supply chain knowledge. When the knowledge gap is less than or equal to a preset knowledge gap, the server updates the historical supply chain knowledge graph based on the knowledge gap to obtain a supply chain knowledge graph. The historical supply chain knowledge graph is obtained using the historical supply chain knowledge. When the knowledge gap is greater than the preset knowledge gap, the server constructs a new supply chain knowledge graph based on the supply chain knowledge.

[0086] Step S108: When it is determined that there is a risk event in the open source software supply chain based on the supply chain knowledge graph, early warning information and emergency response strategies for the risk event are issued.

[0087] Among them, risk events refer to the first software events that may occur and pose a serious threat to the security of the open source software supply chain after their occurrence.

[0088] Among them, emergency response strategies are used to characterize solutions to risk events.

[0089] Specifically, based on the supply chain knowledge graph, the server can obtain the first software event that may occur in the open source software supply chain through inference and prediction; based on the supply chain knowledge graph, the server determines that the possible first software event will cause a serious threat and determines the possible first software event as a risk event; then, the server generates early warning information for the risk event, and generates an emergency response strategy for the risk event based on the supply chain knowledge graph, and then issues the early warning information and the emergency response strategy.

[0090] In specific applications, the server can send warning information and emergency response strategies to the security management terminal associated with the server.

[0091] In specific applications, the server displays warning information and emergency response strategies through the server front end or the security management terminal front end.

[0092] In this embodiment, there are one or more open source software, that is, the user can build an independent supply chain knowledge graph for each open source software separately, or represent the open source software supply chain of each open source software in the same knowledge graph.

[0093] In the above-mentioned security management method for the open source software supply chain, first, the server collects the related information of the open source software; then, the server extracts from the related information the entities in the open source software supply chain of the open source software, the software events in the open source software supply chain that are related to the security risks of the open source software, and the association relationships between the entities as the supply chain knowledge of the open source software supply chain; each entity includes at least the components, vulnerabilities and patches corresponding to the open source software, and the software events include at least the first software event that increases the security risk and the second software event that reduces the security risk; then, the server obtains the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge; then, when the server determines that there is a risk event in the open source software supply chain based on the supply chain knowledge graph, it issues early warning information and emergency response strategies for the risk event. In this way, through information extraction, the server can extract entities such as components, vulnerabilities and patches in the open source software supply chain, the first software event that increases the security risk of the open source software and the second software event that reduces the security risk of the open source software, as well as the relationship between each entity from the related information of the open source software, thereby obtaining the supply chain knowledge of the open source software supply chain; based on the supply chain knowledge, the server can obtain the corresponding supply chain knowledge graph; based on the supply chain knowledge graph, the server can detect the existence of risk events in the open source software supply chain, and in the event of a risk event, issue corresponding warning information and emergency response strategies; the security management method of the open source software supply chain based on the above process can provide timely warnings for risk events in the open source software supply chain and provide emergency response strategies, thereby reducing the security risks of the open source software supply chain.

[0094] In an exemplary embodiment, Figure 2 As shown, the above step S104 extracts, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain that are associated with the security risks of the open source software, and the association relationships between the entities, and specifically includes the following steps:

[0095] In step S202 , based on the pre-trained knowledge extraction model, components, vulnerabilities, and patches corresponding to the open source software are extracted from the associated information to obtain entities.

[0096] In step S204 , based on the knowledge extraction model and the entities, first software events that increase security risks and second software events that reduce security risks in the open source software supply chain are extracted from the associated information to obtain software events.

[0097] Step S206, based on the knowledge extraction model, extract the first association relationship between each component, the second association relationship between each component and each vulnerability, the third association relationship between each patch and each vulnerability, and the fourth association relationship between each component and each patch from the association information and each software event to obtain the association relationship between each entity.

[0098] Step S208: Determine each entity, the relationship between entities, and each software event as supply chain knowledge of the open source software supply chain.

[0099] The first association relationship between two components represents whether there is a dependency relationship between the two components; for example, the first association relationship between component A and component B represents whether the application of component A depends on the application of component B.

[0100] The second association relationship between each component and each vulnerability represents whether there is a vulnerability in the component; for example, the second association relationship between component A and vulnerability A represents whether there is vulnerability A in component A.

[0101] Among them, the third association relationship between each patch and each vulnerability represents whether the patch is a patch released for the vulnerability; for example, the third association relationship between patch A and vulnerability A represents whether patch A is a patch released for vulnerability A, that is, whether patch A can fix vulnerability A.

[0102] The fourth association relationship between each component and each patch represents whether the patch is applied to the component; for example, the fourth association relationship between component A and patch A represents whether patch A is applied to component A.

[0103] Among them, the pre-trained knowledge extraction model is implemented based on the large language model; the knowledge extraction model can be obtained by fine-tuning the general large language model based on the open source software supply chain fine-tuning dataset.

[0104] Specifically, the server inputs the associated information into a knowledge extraction model. Using the semantic understanding and text generation capabilities of the knowledge extraction model, the server first extracts the components, vulnerabilities, and patches corresponding to the open source software from the associated information. Then, based on the components, vulnerabilities, and patches, the server extracts first software events that increase security risks and second software events that reduce security risks from the associated information. Finally, based on the components, vulnerabilities, patches, first software events, and second software events, the server extracts the associations between the components, vulnerabilities, and patches from the associated information. Based on the extracted components, vulnerabilities, patches, first software events, second software events, and the associations between the components, vulnerabilities, and patches, the server obtains supply chain knowledge for the open source software.

[0105] In specific applications, after obtaining supply chain knowledge such as each component, each vulnerability, each patch, each first software event, each second software event, and the relationship between each component, each vulnerability and each patch, since the sources and expressions of each supply chain knowledge are different, the server can perform knowledge fusion on the supply chain knowledge based on entity alignment and conflict detection strategies to ensure the accuracy and consistency of the supply chain knowledge.

[0106] In actual applications, the server measures the knowledge processing efficiency of the knowledge extraction model using the following formula 1:

[0107] (Formula 1)

[0108] in, For knowledge processing efficiency, is the total number of knowledge categories, For the Class knowledge, For the The weight of class knowledge, For the The quality score of class knowledge, For processing time, For resource consumption.

[0109] The classification of knowledge includes but is not limited to classification according to its source, classification according to its entity type, association relationship and software event, etc.

[0110] Among them, the quality score of knowledge can be obtained through user scoring or through artificial intelligence scoring.

[0111] In this embodiment, the server utilizes the capabilities of a large language model to quickly and accurately extract supply chain knowledge from the open source software supply chain, avoiding the time and labor costs of manual aggregation and improving the efficiency of acquiring supply chain knowledge.

[0112] In an exemplary embodiment, Figure 3 As shown, the above step S106, based on the supply chain knowledge, obtains the supply chain knowledge graph of the open source software supply chain, which specifically includes the following steps:

[0113] Step S302: construct a node corresponding to each entity.

[0114] Step S304: determining the connection edges between the nodes based on the association relationships between the entities.

[0115] Step S306: Determine the weight of the connection edge between each node based on each software event.

[0116] Step S308: construct a supply chain knowledge graph based on each node, the connection edges between each node, and the weights of the connection edges between each node.

[0117] The weight of the connection edge is used to represent the degree of association between the entities corresponding to the two nodes connected by the connection edge.

[0118] Specifically, the process of the server building the supply chain knowledge graph is as follows:

[0119] First, the server builds a corresponding node for each entity; for example, a component node for each component, a vulnerability node for each vulnerability, and a patch node for each patch. The node attributes include the entity attributes of the entity corresponding to the node and the update time of the node.

[0120] Then, the server determines the connection edges between the nodes based on the association relationship between the entities; for example, connecting the component node corresponding to the component with the first association relationship, connecting the component node and the vulnerability node corresponding to the component and the vulnerability with the second association relationship, connecting the patch node and the vulnerability node corresponding to the patch and the vulnerability with the third association relationship, and connecting the component node and the patch node corresponding to the component and the patch with the fourth association relationship.

[0121] Next, the server determines the weight of the connection edge between the nodes corresponding to the entities involved in each software event based on the event attributes such as the number of occurrences, severity, and importance of each software event. For example, the weight of the connection edge between the nodes corresponding to the entities involved in the software event with more occurrences is higher. For example, the more times component A has vulnerability A, the higher the weight of the connection edge between the component node corresponding to component A and the vulnerability node corresponding to vulnerability A. For another example, the weight of the connection edge between the nodes corresponding to the entities involved in the first software event with more serious security threats is higher. For example, the more serious the threat posed by vulnerability A to component A, the higher the weight of the connection edge between the component node corresponding to component A and the component node corresponding to vulnerability A. For another example, the weight of the connection edge between the nodes corresponding to the entities involved in the second software event with higher importance is higher. For example, the more important patch A is to the repair of vulnerability A, the higher the weight of the connection edge between the patch node corresponding to patch A and the vulnerability node corresponding to vulnerability A.

[0122] Finally, the server constructs a supply chain knowledge graph based on the above-mentioned nodes, the connecting edges between the nodes, and the weights of the connecting edges between the nodes.

[0123] It is easy to understand that based on the nodes in the supply chain knowledge graph, the node attributes of each node, the connecting edges between each node, and the weights of the connecting edges between each node, it is possible to characterize the mutual influence between each component, each vulnerability, and each patch in the open source software supply chain, and then to characterize and predict the security development trend of the open source software supply chain based on the supply chain knowledge graph.

[0124] In this embodiment, the server can construct a supply chain knowledge graph by determining the nodes, determining the connecting edges between the nodes, and determining the weights of the connecting edges. Based on the supply chain knowledge graph, it can characterize the mutual influence between the components, vulnerabilities, and patches in the open source software supply chain, and then characterize and predict the security development trend of the open source software supply chain based on the supply chain knowledge graph, thereby achieving timely early warning of risk events and providing emergency response strategies, thereby reducing the security risks of the open source software supply chain.

[0125] In an exemplary embodiment, the nodes in the supply chain knowledge graph include at least a component node corresponding to each component, a vulnerability node corresponding to each vulnerability, and a patch node corresponding to each patch.

[0126] like Figure 4 As shown, the above step S108, when it is determined based on the supply chain knowledge graph that there is a risk event in the open source software supply chain, issues warning information and emergency response strategies for the risk event, specifically includes the following steps:

[0127] Step S402: for each vulnerability node in the supply chain knowledge graph, determine the risk information of the vulnerability node based on the connection relationship between the vulnerability node and the remaining nodes in the supply chain knowledge graph.

[0128] Step S404: When the risk information is greater than or equal to the preset risk information, a risk event corresponding to a vulnerability node in the open source software supply chain is determined.

[0129] Step S406: Generate warning information for the risk event, and determine an emergency response strategy for the risk event based on the connection relationship between the vulnerability node and the remaining nodes.

[0130] Step S408: issuing warning information and emergency response strategies.

[0131] Among them, risk information is used to characterize the degree of harm to the open source software supply chain after the vulnerability corresponding to the vulnerability node occurs. Risk information is related to the probability of occurrence, scope of impact and difficulty of repair of the vulnerability.

[0132] Among them, the connection relationship between nodes is represented by the connection edges between the node relationships and the weights of the connection edges; in specific applications, the connection relationship between two nodes can be divided into primary connection, secondary connection, tertiary connection... etc. according to whether there are other nodes between the two nodes.

[0133] Specifically, for each vulnerability node in the supply chain knowledge graph, the server uses the risk warning model, based on the rule reasoning ability and deep learning ability of the risk warning model, and based on the remaining nodes that are connected to the vulnerability node, to predict the probability of occurrence, scope of impact and repair difficulty of the vulnerability corresponding to the vulnerability node, and then evaluates the risk information corresponding to the vulnerability node; then, when the risk information is greater than or equal to the preset risk information, the server determines that the vulnerability corresponding to the vulnerability node may occur, and after occurrence, it will pose a serious threat to the security of the open source software supply chain, that is, there is a risk event corresponding to the vulnerability node in the open source software supply chain; then, the server generates warning information for the risk event, and determines the emergency response strategy for the risk event based on the remaining nodes that are connected to the vulnerability node; finally, the server issues warning information and emergency response strategy.

[0134] The risk warning model is a pre-trained machine learning or deep learning model. In specific applications, users can configure corresponding risk warning rules and emergency response strategy generation rules for the risk warning model based on the company's actual situation, so that the risk warnings and emergency response strategies provided are more in line with the company's actual needs.

[0135] For example, assuming that the server predicts the probability of occurrence and impact of vulnerability A based on the supply chain knowledge graph, and then assesses that the degree of harm to the open source software supply chain after the occurrence of vulnerability A is high, then the server further provides a repair strategy for vulnerability A based on the supply chain knowledge graph, such as using patch B to repair components A and component B to prevent the occurrence of vulnerability A from causing harm to components A and component B, or component C can replace component A, and vulnerability A will not occur in component C. Therefore, component C is used to replace component A to avoid the harm caused by the occurrence of vulnerability A, etc.

[0136] In this embodiment, the server can evaluate the hazards of vulnerabilities in the open source software supply chain through the supply chain knowledge graph and generate targeted countermeasures, thereby improving the security of the open source software supply chain.

[0137] In an exemplary embodiment, the above step S402 determines the risk information of the vulnerability node based on the connection relationship between the vulnerability node and the remaining nodes in the supply chain knowledge graph, specifically including the following contents: determining the impact area of ​​the vulnerability node in the supply chain knowledge graph based on the connection relationship between the vulnerability node and the component nodes in the supply chain knowledge graph; determining the risk information of the vulnerability node based on the component nodes in the impact area, and the connection relationship between the vulnerability node and the component nodes in the impact area.

[0138] Among them, the impact area is used to represent the impact range of the vulnerability corresponding to the vulnerability node.

[0139] Among them, the component nodes in the impact area are used to represent the components that will be affected after the vulnerability corresponding to the vulnerability node occurs.

[0140] Specifically, the server determines the impact range of the vulnerability corresponding to the vulnerability node based on the connection relationship between the vulnerability node and the component nodes in the supply chain knowledge graph, and obtains the impact area of ​​the vulnerability node in the supply chain knowledge graph; then, the server determines the risk information of the vulnerability node based on the importance of the components corresponding to the component nodes in the impact area in the open source software supply chain, and the weights of the connecting edges between these component nodes and the vulnerability node. For example, the importance of the components is weighted and summed according to the weights of the corresponding connecting edges to obtain the risk information of the vulnerability node; further, in the process of determining the risk information, the number of component nodes in the impact area can also be considered, that is, the risk information is determined in combination with the number of components affected by the vulnerability corresponding to the vulnerability node.

[0141] In a specific application, the server determines the impact range based on the attenuation effect of the impact. For example, the server determines the impact area of ​​the vulnerable node based on the component nodes whose connection relationship with the vulnerable node is within the third level of connection.

[0142] The above-mentioned step S406 determines the emergency response strategy for the risk event based on the connection relationship between the vulnerability node and the remaining nodes, which specifically includes the following contents: based on the connection relationship between the vulnerability node and the patch node in the affected area, the target patch node for repairing the vulnerability node is determined among the patch nodes in the affected area; based on the connection relationship between the vulnerability node and the component nodes in the affected area, the target component node to be applied to the target patch node is determined among the component nodes in the affected area; based on the target patch node and the target component node, the emergency response strategy for the risk event is determined.

[0143] Specifically, the server determines, among the patch nodes in the impact area, a target patch node for repairing the vulnerability node based on the connection relationship between the vulnerability node and the patch nodes in the impact area; for example, among the patch nodes in the impact area, the server determines, based on the connection edges and weights between the vulnerability node and the patch nodes in the impact area, a patch node that is connected to the vulnerability node and has the largest weight of the corresponding connection edge (among the vulnerability node and each patch node in the impact area) as the target patch node.

[0144] At the same time, the server determines the target component node of the target patch node to be applied among the component nodes in the impact area based on the connection relationship between the vulnerability node and the component nodes in the impact area; for example, among the component nodes in the impact area, the server determines the component node that can block the spread of the vulnerability corresponding to the vulnerability node as the target component node based on the connection edge and its weight between the vulnerability node and the component nodes in the impact area.

[0145] Then, the server generates an emergency response strategy based on the target patch node and the target component node to provide users with solutions to the risk events corresponding to the vulnerability node.

[0146] In this embodiment, the server determines the vulnerability's propagation path and scope based on the connections between vulnerability nodes and component nodes in the supply chain knowledge graph, thereby assessing the impact of the vulnerability. Based on the connections between vulnerability nodes and patch nodes, and between vulnerability nodes and component nodes in the affected area, the server provides corresponding solutions for the vulnerabilities corresponding to the vulnerability nodes, mitigating threats to the open source software supply chain after the vulnerability occurs and ensuring its security.

[0147] In an exemplary embodiment, in the above step S106, after obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the following contents are specifically included: receiving a query request for the open source software supply chain; locating the target node associated with the query request in each node in the supply chain knowledge graph; generating a query result corresponding to the query request based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph; and displaying the query result.

[0148] Specifically, the server also provides a query function based on the large language model; the server receives the query request input by the user, and locates at least one target node associated with the query request in each node in the supply chain knowledge graph, and based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph, generates the query result corresponding to the query request and returns it to the user.

[0149] For example, if a user needs to query the dependency relationship between component A and other components, the server can search the supply chain knowledge graph for component nodes that are connected to the component node corresponding to component A and return the components corresponding to these component nodes to the user. For another example, if a user needs to query the impact of vulnerability B on the open source software supply chain, the server can locate the vulnerability node corresponding to vulnerability B based on the supply chain knowledge graph and, based on the connection relationship between this vulnerability node and the other nodes, evaluate the risk information corresponding to this vulnerability node, thereby obtaining the risk information of vulnerability B and returning it to the user.

[0150] In specific applications, the query result can be text or a partial area in the supply chain knowledge graph; that is, the server can generate and return the result text corresponding to the query request based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph, or it can intercept and return the sub-graph corresponding to the query request in the supply chain knowledge graph based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph.

[0151] In specific applications, the server can display the query results through the server front end or the security management terminal front end.

[0152] In this embodiment, the server provides a query function. Based on the query function, users can quickly obtain the information they need, which facilitates the management of the open source software supply chain.

[0153] In an exemplary embodiment, the server provides a multi-level storage engine: first, the server stores related information in the database and provides full-text query capabilities based on Elasticsearch (a distributed search and analysis engine) for the database; second, the server stores the supply chain knowledge graph in the Neo4j (a high-performance NOSQL graph database) database, thereby improving the graph query capability; third, for query requests initiated by users more frequently, the server caches the query results in the Redis (a distributed cache database) database.

[0154] Based on the above multi-level storage engine, when a user enters a query request, the server first searches for the corresponding query result in Redis. If the result exists, it is returned directly. If not, it is searched based on Neo4j. When the user chooses to use Elasticsearch for full-text query, the query result is obtained from the database.

[0155] In an exemplary embodiment, in the above step S106, after obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the following contents are specifically included: based on the connection relationship between each node in the supply chain knowledge graph, determining the indicator value of the open source software supply chain under at least one security risk indicator; displaying the supply chain knowledge graph and the indicator value of the open source software supply chain under each security risk indicator.

[0156] Specifically, the server determines the index value of the open source software supply chain under at least one security risk indicator based on the connection relationship between each node in the supply chain knowledge graph, such as the component security index, vulnerability risk index, and overall security index of the open source software supply chain.

[0157] Then, the server displays the supply chain knowledge graph and the indicator values ​​of the open source software supply chain under various security risk indicators, so that users can view the open source software supply chain at any time and grasp the real-time security risk situation of the open source software supply chain in a timely manner.

[0158] In specific applications, the server can display the supply chain knowledge graph and the indicator values ​​of the open source software supply chain under various security risk indicators through the server front end or the security management terminal front end.

[0159] In specific applications, users can interact with the displayed supply chain knowledge graph, such as zooming in, zooming out, and filtering, to view some information in the open source software supply chain.

[0160] In specific applications, the server can display indicator values ​​in the form of charts to help users promptly identify potential security issues and provide strong support for the security management of the open source software supply chain.

[0161] In this embodiment, the security risk index includes at least a risk propagation index between components in the open source software supply chain. The risk propagation index between components can be expressed by the following formula 2:

[0162] (Formula 2)

[0163] in, Between the components The risk spread index at the moment, that is, the scope of risk impact, is the initial risk impact range, is the risk diffusion coefficient, is the risk attenuation coefficient. This formula reflects the diffusion and attenuation process of security risks in the supply chain network and provides an important reference for analyzing the risk propagation mechanism.

[0164] In this embodiment, the server can display the real-time security risk situation of the open source software supply chain by displaying the supply chain knowledge graph and indicator values, so that users can promptly discover potential security issues and provide strong support for the security management of the open source software supply chain.

[0165] To more clearly illustrate the open source software supply chain security management method provided by the embodiments of this application, the following describes the open source software supply chain security management method using a specific embodiment. However, it should be understood that the embodiments of this application are not limited to this. In one exemplary embodiment, this application also provides an open source software supply chain security knowledge management method and system based on a large language model, which specifically includes the following contents:

[0166] like Figure 5 As shown, this embodiment provides an open source software supply chain security knowledge management system based on a large language model; the system includes at least a data acquisition layer, a knowledge extraction and fusion layer, a knowledge representation and storage layer, an intelligent reasoning and decision-making layer, and a visual interaction layer.

[0167] Among them, the data acquisition layer includes a data acquisition module and a data preprocessing module; the data acquisition module is used to collect related information related to open source software from the Internet; the data preprocessing module is used to preprocess the related information to facilitate subsequent knowledge extraction.

[0168] Among them, the knowledge extraction and fusion layer is implemented based on a large language model, including an entity recognition module, an event extraction module, a relationship extraction module and a knowledge fusion module; the entity recognition module is used to identify named entities from associated information; the event extraction module is used to extract events containing named entities from associated information; the relationship extraction module is used to extract the relationship between each entity from associated information and events; the knowledge fusion module is used to fuse the above-extracted knowledge to eliminate its redundancy and repetition.

[0169] Among them, the knowledge representation and storage layer includes a knowledge graph construction module, a graph database, a distributed cache database, a global database, and a search engine; the knowledge graph construction module is used to construct a knowledge graph based on the knowledge extracted by the knowledge extraction and fusion layer; the graph database is used to store the knowledge graph; the distributed cache database is used to store knowledge that is frequently accessed by users; the global database is used to store related information, and the search engine is used to support searches in the global database.

[0170] Among them, the intelligent reasoning and decision-making layer is implemented based on the reasoning engine, including the reasoning module and the decision-making module; the reasoning module is used to infer security risks in the open source software supply chain; the decision-making module is used to generate response strategies for the inferred security risks that need to be handled.

[0171] Among them, the visual interaction layer is used to display the knowledge graph and the real-time security risk situation of the open source software supply chain based on the knowledge graph to users.

[0172] In this embodiment, the system also provides an identity authentication function, and all users using the system need to pass identity authentication.

[0173] In this real-time, the system also limits the request frequency of the system interface based on the token bucket algorithm to ensure the stability and reliability of the system under high concurrency conditions.

[0174] In this embodiment, the method and system provided by this embodiment have brought about a qualitative leap in the open source software supply chain security knowledge management based on a large language model in terms of specific business functions such as information acquisition, knowledge management, and decision support.

[0175] First, the efficiency of information acquisition has been greatly improved. Under existing technologies, a large number of links in the information acquisition process rely on manual intervention, such as data screening and preliminary organization. This not only consumes a lot of time and human resources, but is also prone to errors and omissions due to human factors. However, this embodiment achieves a high degree of automation in the information acquisition process by introducing advanced intelligent automation technology. From the automatic identification and connection of data sources to the automatic collection, classification, and preliminary analysis of data, this embodiment can complete most of the work autonomously, requiring only minimal manual supervision and correction. This highly automated operating mode greatly improves the efficiency and stability of information acquisition, reduces the burden of manual operation, and makes the information acquisition process smoother and more reliable.

[0176] Second, data accuracy has been greatly improved. Since open source software data comes from a wide range of sources and is complex, it suffers from issues such as inconsistent data formats and varying data quality. Existing technologies have shortcomings in data cleaning, integration, and verification, resulting in low data accuracy. This embodiment, by designing data cleaning and verification algorithms and combining them with machine learning and data mining techniques, can more accurately identify and process abnormal, duplicate, and incomplete data.

[0177] Third, the effectiveness of knowledge management has been greatly improved. In the existing technology, first, the update cycle of knowledge management is long, which affects the ability to identify and analyze the latest security risks. Secondly, there is a lack of comprehensive coverage of the complex and diverse knowledge structure and extensive knowledge fields of open source software, resulting in a low knowledge coverage rate. This embodiment achieves rapid updates to knowledge management by establishing a real-time data monitoring mechanism and an automated knowledge update process. At the same time, through in-depth understanding and analysis of the open source software supply chain, a comprehensive and detailed knowledge graph structure is constructed, covering all aspects of open source software. In addition, multi-source data fusion technology and semantic analysis technology are introduced in the data collection and knowledge fusion process, which can extract and analyze relevant information from various different data sources, fill knowledge gaps, and thus improve the ability to respond to security risks in the open source software supply chain.

[0178] Fourth, decision-making knowledge capabilities have been greatly enhanced. Existing technologies have difficulty accurately identifying complex security risks during the risk identification process, and lack comprehensive consideration of actual conditions and personalized analysis, resulting in low applicability of decision recommendations. This embodiment introduces advanced machine learning and deep learning algorithms, combined with big data analysis and data mining technologies, to build a more complex and accurate risk identification model. This model can learn patterns and regularities in historical security data, automatically mine potential security risk factors, and perform real-time analysis and prediction of new data. At the same time, this embodiment introduces an intelligent decision-making support system, combines domain expert knowledge and actual case data, and builds a more flexible and intelligent decision recommendation generation mechanism. This mechanism can automatically generate personalized decision recommendations based on different risk scenarios and user needs, and adjust and optimize decision plans in real time.

[0179] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0180] Based on the same inventive concept, embodiments of the present application also provide an open source software supply chain security management system for implementing the aforementioned open source software supply chain security management method. The implementation solution provided by this system is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more open source software supply chain security management system embodiments provided below can be found in the above-mentioned limitations of the open source software supply chain security management method, and will not be repeated here.

[0181] In an exemplary embodiment, Figure 6 As shown, a security management system for an open source software supply chain is provided, comprising: an information collection layer 602, a knowledge extraction layer 604, a knowledge representation layer 606, and a risk warning layer 608, wherein:

[0182] The information collection layer 602 is used to collect relevant information of open source software.

[0183] The knowledge extraction layer 604 is used to extract the entities in the open source software supply chain of the open source software, the software events in the open source software supply chain that are associated with the security risks of the open source software, and the association relationships between the entities as the supply chain knowledge of the open source software supply chain; each entity includes at least the components, vulnerabilities and patches corresponding to the open source software, and the software events include at least a first software event that increases security risks and a second software event that reduces security risks.

[0184] The knowledge representation layer 606 is used to obtain a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge.

[0185] The risk warning layer 608 is used to issue warning information and emergency response strategies for risk events when it is determined that there are risk events in the open source software supply chain based on the supply chain knowledge graph.

[0186] In an exemplary embodiment, the knowledge extraction layer 604 is further configured to extract, from the association information, components, vulnerabilities, and patches corresponding to the open source software based on a pre-trained knowledge extraction model, to obtain entities; extract, from the association information, first software events that increase security risks and second software events that reduce security risks in the open source software supply chain based on the knowledge extraction model and the entities, to obtain software events; extract, from the association information and the software events, first association relationships between components, second association relationships between components and vulnerabilities, third association relationships between patches and vulnerabilities, and fourth association relationships between components and patches based on the knowledge extraction model, to obtain association relationships between entities; determine the entities, the association relationships between entities, and the software events as supply chain knowledge of the open source software supply chain; wherein, the first association relationship between two components indicates whether there is a dependency relationship between the two components; the second association relationship between each component and each vulnerability indicates whether there is a vulnerability in the component; the third association relationship between each patch and each vulnerability indicates whether the patch is released for the vulnerability; and the fourth association relationship between each component and each patch indicates whether the component has applied the patch.

[0187] In an exemplary embodiment, the knowledge representation layer 606 is also used to construct a node corresponding to each entity; determine the connection edges between each node based on the association relationship between each entity; determine the weight of the connection edges between each node based on each software event; and construct a supply chain knowledge graph based on each node, the connection edges between each node, and the weight of the connection edges between each node.

[0188] In an exemplary embodiment, the nodes in the supply chain knowledge graph include at least a component node corresponding to each component, a vulnerability node corresponding to each vulnerability, and a patch node corresponding to each patch.

[0189] The risk warning layer 608 is also used to determine the risk information of each vulnerability node in the supply chain knowledge graph based on the connection relationship between the vulnerability node and the remaining nodes in the supply chain knowledge graph; when the risk information is greater than or equal to the preset risk information, determine the risk event corresponding to the vulnerability node in the open source software supply chain; generate warning information for the risk event, and determine the emergency response strategy for the risk event based on the connection relationship between the vulnerability node and the remaining nodes; and issue warning information and emergency response strategy.

[0190] In an exemplary embodiment, the risk warning layer 608 is further configured to determine an impact area of ​​the vulnerability node in the supply chain knowledge graph based on a connection relationship between the vulnerability node and component nodes in the supply chain knowledge graph; determine risk information of the vulnerability node based on component nodes in the impact area and the connection relationship between the vulnerability node and component nodes in the impact area;

[0191] The risk warning layer 608 is also used to determine the target patch node for repairing the vulnerability node among the patch nodes in the impact area based on the connection relationship between the vulnerability node and the patch nodes in the impact area, and to determine the target component node to be applied to the target patch node among the component nodes in the impact area based on the connection relationship between the vulnerability node and the component nodes in the impact area; and to determine the emergency response strategy for the risk event based on the target patch node and the target component node.

[0192] In an exemplary embodiment, the security management system of the open source software supply chain also includes a query layer for receiving query requests for the open source software supply chain; locating the target node associated with the query request in each node in the supply chain knowledge graph; generating query results corresponding to the query request based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph; and displaying the query results.

[0193] In an exemplary embodiment, the security management system of the open source software supply chain also includes a visualization interaction layer for determining the index value of the open source software supply chain under at least one security risk indicator based on the connection relationship between each node in the supply chain knowledge graph; and displaying the supply chain knowledge graph and the index value of the open source software supply chain under each security risk indicator.

[0194] Each module in the aforementioned open source software supply chain security management system can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor within a computer device in hardware form, or stored in a computer device's memory in software form, allowing the processor to call and execute the corresponding operations of each module.

[0195] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store associated information of open source software. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a security management method for the open source software supply chain is implemented.

[0196] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0197] In an exemplary embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0198] In an exemplary embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0199] In an exemplary embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0200] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0201] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0202] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A security management method for an open source software supply chain, characterized in that: The method comprises: Collect information related to open source software; Extracting, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain that are associated with security risks of the open source software, and association relationships between the entities as supply chain knowledge of the open source software supply chain; the entities at least including components, vulnerabilities, and patches corresponding to the open source software; and the software events at least including a first software event that increases the security risk and a second software event that reduces the security risk; Based on the supply chain knowledge, a supply chain knowledge graph of the open source software supply chain is obtained; the supply chain knowledge graph uses the entities as nodes and the association relationships between the entities as connecting edges between the nodes; the weight of each connecting edge is determined based on the software events, and the weight of each connecting edge is used to represent the degree of association between the entities corresponding to the two nodes connected by the connecting edge; the nodes in the supply chain knowledge graph include at least a component node corresponding to each component, a vulnerability node corresponding to each vulnerability, and a patch node corresponding to each patch; When it is determined that a risk event exists in the open source software supply chain based on the supply chain knowledge graph, issuing early warning information and emergency response strategies for the risk event based on the supply chain knowledge graph; The method further includes: for each vulnerability node in the supply chain knowledge graph, based on the connection relationship between the vulnerability node and the component nodes in the supply chain knowledge graph, determining the impact area of ​​the vulnerability node in the supply chain knowledge graph; performing weighted summation of the importance of components corresponding to the component nodes in the impact area in the open source software supply chain according to the weights of the connection edges between the vulnerability node and the component nodes in the impact area, to obtain risk information of the vulnerability node; and determining that a risk event corresponding to the vulnerability node exists in the open source software supply chain when the risk information is greater than or equal to a preset risk information; Among them, the association relationships between the entities include at least a first association relationship between components, a second association relationship between the components and the vulnerabilities, a third association relationship between the patches and the vulnerabilities, and a fourth association relationship between the components and the patches; the first association relationship between two components indicates whether there is a dependency relationship between the two components; the second association relationship between each component and each vulnerability indicates whether the vulnerability exists in the component; the third association relationship between each patch and each vulnerability indicates whether the patch is a patch released for the vulnerability; the fourth association relationship between each component and each patch indicates whether the patch is applied to the component.

2. The method according to claim 1, characterized in that Extracting, from the association information, entities in the open source software supply chain of the open source software, software events in the open source software supply chain associated with security risks of the open source software, and association relationships between the entities includes: Based on a pre-trained knowledge extraction model, extracting components, vulnerabilities, and patches corresponding to the open source software from the associated information to obtain the entities; Extracting, from the associated information, first software events that increase the security risk and second software events that reduce the security risk in the open source software supply chain based on the knowledge extraction model and the entities, to obtain the software events; Extracting, based on the knowledge extraction model, from the association information and the software events, a first association relationship between the components, a second association relationship between the components and the vulnerabilities, a third association relationship between the patches and the vulnerabilities, and a fourth association relationship between the components and the patches, to obtain association relationships between the entities; The entities, the relationships between the entities, and the software events are determined as supply chain knowledge of the open source software supply chain.

3. The method according to claim 1, characterized in that The step of obtaining a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge includes: Construct the node corresponding to each entity; Determine the connection edges between the nodes based on the association relationships between the entities; Determining the weight of the connection edge between the nodes based on the software events; The supply chain knowledge graph is constructed based on the nodes, the connecting edges between the nodes, and the weights of the connecting edges between the nodes.

4. The method according to claim 1, wherein The issuing of early warning information and emergency response strategies for the risk event based on the supply chain knowledge graph includes: Generate early warning information for the risk event, and determine an emergency response strategy for the risk event based on the connection relationship between the vulnerability node and the remaining nodes in the supply chain knowledge graph; The early warning information and the emergency response strategy are issued.

5. The method according to claim 4, characterized in that Determining an emergency response strategy for the risk event based on the connection relationship between the vulnerability node and the remaining nodes in the supply chain knowledge graph includes: Based on the connection relationship between the vulnerability node and the patch nodes in the affected area, determining a target patch node for repairing the vulnerability node among the patch nodes in the affected area; based on the connection relationship between the vulnerability node and the component nodes in the affected area, determining a target component node to which the target patch node is to be applied among the component nodes in the affected area; An emergency response strategy for the risk event is determined based on the target patch node and the target component node.

6. The method according to any one of claims 1 to 5, characterized in that After obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the method further includes: receiving a query request for the open source software supply chain; Locating a target node associated with the query request among the nodes in the supply chain knowledge graph; Generate a query result corresponding to the query request based on the connection relationship between the target node and the remaining nodes in the supply chain knowledge graph; The query results are displayed.

7. The method according to any one of claims 1 to 5, characterized in that After obtaining the supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge, the method further includes: Determining an indicator value of the open source software supply chain under at least one security risk indicator based on a connection relationship between nodes in the supply chain knowledge graph; Display the supply chain knowledge graph and the indicator values ​​of the open source software supply chain under various security risk indicators.

8. A security management system for an open source software supply chain, characterized in that: The system comprises: Information collection layer, used to collect relevant information about open source software; a knowledge extraction layer for extracting, as supply chain knowledge of the open source software supply chain, entities in the open source software supply chain, software events in the open source software supply chain that are associated with security risks of the open source software, and relationships between the entities; wherein the entities include at least components, vulnerabilities, and patches corresponding to the open source software, and the software events include at least a first software event that increases the security risk and a second software event that reduces the security risk; A knowledge representation layer is configured to obtain a supply chain knowledge graph of the open source software supply chain based on the supply chain knowledge; the supply chain knowledge graph uses the entities as nodes and the associations between the entities as edges between the nodes; the weight of each edge is determined based on the software events, and the weight of each edge is used to represent the degree of association between the entities corresponding to the two nodes connected by the edge; the nodes in the supply chain knowledge graph include at least a component node corresponding to each component, a vulnerability node corresponding to each vulnerability, and a patch node corresponding to each patch; A risk warning layer, configured to, upon determining, based on the supply chain knowledge graph, that a risk event exists in the open source software supply chain, issue warning information and an emergency response strategy for the risk event based on the supply chain knowledge graph; The risk warning layer is further configured to determine, for each vulnerability node in the supply chain knowledge graph, an impact area of ​​the vulnerability node in the supply chain knowledge graph based on the connection relationship between the vulnerability node and the component nodes in the supply chain knowledge graph; perform a weighted sum of the importance of the components corresponding to the component nodes in the impact area in the open source software supply chain according to the weights of the connecting edges between the vulnerability node and the component nodes in the impact area, to obtain risk information of the vulnerability node; and determine that a risk event corresponding to the vulnerability node exists in the open source software supply chain if the risk information is greater than or equal to a preset risk information; Among them, the association relationships between the entities include at least a first association relationship between components, a second association relationship between the components and the vulnerabilities, a third association relationship between the patches and the vulnerabilities, and a fourth association relationship between the components and the patches; the first association relationship between two components indicates whether there is a dependency relationship between the two components; the second association relationship between each component and each vulnerability indicates whether the vulnerability exists in the component; the third association relationship between each patch and each vulnerability indicates whether the patch is a patch released for the vulnerability; the fourth association relationship between each component and each patch indicates whether the patch is applied to the component.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images